chore: pin the schemas submodule to its current release tag

.gitmodules

@@ -1,6 +1,27 @@
+# The `branch` line below is load-bearing, not decorative.
+#
+# Renovate's git-submodules manager reads `branch` as the dependency's current
+# version. With it, a new submodule release arrives as an ordinary version PR
+# that bumps both the pointer and the `branch` value. Without it there is no
+# version to compare against, so Renovate can only chase the upstream default
+# branch instead -- which is not what we want to track, and which
+# open-feature/community-tooling#126 switches off entirely.
+#
+# `protobuf-v*` is a release-please component tag. It needs the prefix rule from
+# open-feature/community-tooling#126 to resolve as a version; until that lands
+# the pin is inert, but harmless.
+#
+# So deleting a `branch` line silently switches off updates for that submodule.
+# That has happened several times; see open-feature/flagd-testbed#398. Keep the
+# pin, and let Renovate move it.
+#
+# `test-harness` is deliberately left unpinned for now: it tracks an untagged
+# commit two ahead of v3.10.1, so pinning it would move the submodule rather than
+# just describe it. See open-feature/community-tooling#125.
 [submodule "providers/openfeature-flagd-provider/schemas"]
 	path = providers/openfeature-flagd-provider/schemas
 	url = https://github.com/open-feature/flagd-schemas
+	branch = protobuf-v0.6.7
 [submodule "providers/openfeature-flagd-provider/test-harness"]
 	path = providers/openfeature-flagd-provider/test-harness
 	url = https://github.com/open-feature/flagd-testbed.git